{"id":"MAL-2026-16357","summary":"Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ffa99497d70b8eae199242d576c111b7b351efcf5d81d613e3f7b43eec257f27)\nThe package declares a preinstall lifecycle script that executes index.js on `npm install`. index.js uses child_process.exec to run a curl command whose URL embeds `$(hostname)` and `$(whoami)` as subdomains of `sgc6vj7rjciuailqx2kfebc7pyvpjk79.oastify.com`, a Burp Collaborator (OAST) host. On install, the installer's hostname and username are transmitted to that attacker-controlled destination via DNS resolution and HTTP. The package name is a random alphanumeric scope with no legitimate functionality; the sole observable behavior is host reconnaissance exfiltration at install time. This is the canonical dependency-confusion / OAST recon payload shape.\n\n## Source: ossf-package-analysis (278821d7a9d245a4193d8536c0b127f61cf1b13335dfe91abaefece6b908a57e)\nThe OpenSSF Package Analysis project identified '@asdfaskdjfksadhfkasf/nadaver2' @ 102.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-09-21T21:46:05.092012822Z","published":"2026-09-21T19:06:07Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-21T19:14:55.95687311Z","modified_time":"2026-09-21T19:06:07Z","sha256":"278821d7a9d245a4193d8536c0b127f61cf1b13335dfe91abaefece6b908a57e","source":"ossf-package-analysis","versions":["102.0.0"]},{"sha256":"ffa99497d70b8eae199242d576c111b7b351efcf5d81d613e3f7b43eec257f27","source":"amazon-inspector","versions":["102.0.0"],"id":"IN-MAL-2026-020277","import_time":"2026-09-21T21:37:44.891663209Z","modified_time":"2026-09-21T21:28:21Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@asdfaskdjfksadhfkasf/nadaver2/v/102.0.0"}],"affected":[{"package":{"name":"@asdfaskdjfksadhfkasf/nadaver2","ecosystem":"npm","purl":"pkg:npm/%40asdfaskdjfksadhfkasf/nadaver2"},"versions":["102.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"nadaver2-102.0.0.tgz","hashes":{"sha1":"381f5eb0bb9cea2aec896f71481ae60ae2d8a880","sha512_sri":"sha512-4++U6OVuH8qMG3KXtAPXRQgW4oKnBY333nJtTeZxfezGtPtzp7BUHBo8DnLNT7k0K4leBs/H9txJZ1XnsJrzvA=="}}],"evidence_files":[{"sha256":"f3f3fe5f70c55104ec31c61a56f4c35001baa21e83a076f89435486d548831b8","tlsh":"11e0c00508f6543732a21850bd2e141a79434a11123bf182a8ce871023c0a84d9051d9","path":"index.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@asdfaskdjfksadhfkasf/nadaver2/MAL-2026-16357.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}